A Dependent Outage Claim Under a Two-Layer Cyber Tower
Halcyon Foods ($900M revenue) buys a $10M cyber tower: a $5M primary layer from Carrier A with a $500,000 self-insured retention, and a $5M excess layer from Carrier B on a following-form basis, subject to a $2M sublimit for dependent business interruption and a $1M sublimit for "system failure" (non-malicious outage). In March a ransomware event at Halcyon's managed logistics provider halted outbound shipments for six days, causing $3.4M of lost gross profit and $600,000 of extra expense; Halcyon's own network was untouched apart from one infected laptop. In November Halcyon's IT director had received, and filed without escalation, a vendor bulletin describing an exposed API at that same provider. In January a $280,000 vendor-impersonation wire fraud was also paid; the policy carries a $250,000 social engineering sublimit.
1. Which coverage parts respond to the March outage, and what will Halcyon actually collect? Address the retention, sublimits and the excess layer.
Read the worked answer
This is dependent (contingent) business interruption: Halcyon's own systems worked; its provider's did not. The $3.4M lost gross profit plus $600,000 extra expense is a $4.0M gross loss against a $2M dependent BI sublimit.
Mechanics: the sublimit caps the recoverable amount before the retention is applied, so $2.0M less the $500,000 retention leaves $1.5M payable by Carrier A. The $5M excess layer never attaches, because the primary limit is not exhausted - a sublimit does not erode the attachment point unless the excess explicitly drops down, and ordinary following form does not. Two wording checks decide the number: whether the sublimit is written as a combined BI and extra expense limit (if extra expense sits outside the sublimit, add up to its own limit), and whether the January wire fraud shares an annual aggregate with the BI claim. The January loss recovers at most $250,000 under its own sublimit, leaving $30,000 uninsured.
2. Carrier A has reserved on prior knowledge, citing the November vendor bulletin. Assess the strength of that position and identify the facts that decide it.
Read the worked answer
The exclusion generally requires knowledge of circumstances from which a reasonable insured would recognize that a claim was likely, and a generic vendor bulletin is usually not enough. Deciding facts:
Specificity - did the bulletin name the API, the vulnerability class and the provider, or was it one of dozens of routine advisories received that month? Routing and escalation - the IT director filed it without escalation, which supports the insured on organizational awareness but hands the insurer an argument that a reasonable professional should have connected an exposed provider API to service-interruption exposure. Timing - was it received before inception or mid-term, and was it disclosable at renewal? Causation - if the outage mechanism differs from the API described, knowledge of a different risk does not defeat coverage. Renewal disclosure - if an application question is answered by the bulletin, a coverage dispute becomes a misrepresentation and rescission risk, which is materially worse.
Halcyon's best posture is a factual showing that the bulletin was routine and never connected to a dependent-BI exposure; the insurer will press on the director's role and any renewal questionnaire.
3. Forensics later concludes the outage was a misconfiguration at the provider, not ransomware. How does the analysis change?
Read the worked answer
The outcome becomes wording-dependent and materially worse for the insured. A malicious attack on a third party normally engages dependent BI or computer-attack coverage; a non-malicious operational failure typically falls under a separate system failure provision, which here carries a $1M sublimit and commonly is restricted to the insured's own systems or to named providers. Recovery would drop from $1.5M to roughly $500,000 ($1M sublimit less the $500,000 retention), and the excess layer is untouched either way.
Further questions: whether the logistics provider is a scheduled outsourced service provider, since unnamed providers are frequently excluded; whether the policy's definition of system failure requires the failure to be at the insured; and whether the logistics contract allocates the loss. The absolute war exclusion is irrelevant on these facts but is worth flagging for state-linked attack scenarios elsewhere in the tower.
The risk-register lesson is that the single-provider dependency, and its size, should have driven the sublimit negotiation at renewal - not the headline tower limit, which never came into play.